Hackers may have stolen personal data at Munich university
TUM says it took two central systems offline after an attack on the student portal.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
Technische Universität München reported a cyberattack on Friday in which attackers may have accessed personal data and passwords. The university temporarily disabled the myTUM portal and the central campus management system TUMonline.
According to TUM, the attackers began by targeting myTUM. Passwords for central TUM systems were reportedly obtained, including the credentials of a TUMonline system administrator. That access was then used to attack the central campus management system.
According to the university, the data potentially affected consists of passwords, names, home addresses and dates of birth. For employees, work addresses and business telephone numbers may also be involved. For students, it may include student numbers, degree programmes and the number of completed semesters.
Based on the log files examined so far, TUM says it assumes that other data from TUMonline, such as grades and applications for degree programmes, was not stolen. The investigation is continuing. The wording means that the university does not currently consider this data compromised, not that all uncertainty has disappeared.
The university says it has suspended affected accounts, taken TUMonline offline, informed the Bavarian data protection regulator and reported the incident to the police. It advises students and staff to change their TUM password and enable multi-factor authentication. TUM says accounts with multi-factor authentication were protected against this attack.
Regional broadcaster BR24 reported on Friday that the systems were still offline and that TUMonline should become available again at the start of next week. The attack follows a cyber incident at Ludwig-Maximilians-Universität München in September. It is not known whether the two incidents are connected. For Dutch educational institutions, the case above all highlights the importance of strong authentication and separate access to central systems.
Also show where in Europe and in the world
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The factual description follows TUM’s current report and independent coverage by BR24. Uncertainty about the extent of the data access has been explicitly retained.
- confirmed TUM reported a cyberattack on myTUM and TUMonline on 6 November. — Confirmed by the official TUM report and BR24. source
- confirmed Passwords, names, addresses and dates of birth may have been accessed. — TUM explicitly names these categories as potentially affected. source
- confirmed TUM currently believes that grades and applications for degree programmes were not stolen. — The university bases this on an analysis of log files and says the investigation is continuing. source
Editor's note
TUM confirms the attack and the data categories potentially affected. The university is still investigating whether other data was accessed; the attackers’ identities and motives are unknown.Sources
- IT Security Incident at TUM — Technische Universität München
- Erneut Hackerangriff auf bayerische Uni – TUM betroffen — BR24